An EDR console shows that an endpoint ran vssadmin.exe delete shadows /all /quiet followed by starting a ransomware encryption process. What was the purpose of the vssadmin command?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because ransomware routinely deletes Volume Shadow Copies (VSS snapshots) before encrypting files to prevent victims from recovering data using Windows' built-in Previous Versions feature, forcing payment for decryption. A is wrong because the /delete flag deletes shadow copies; creating them uses vssadmin create shadow.
Full explanation below image
Full Explanation
B is correct because ransomware routinely deletes Volume Shadow Copies (VSS snapshots) before encrypting files to prevent victims from recovering data using Windows' built-in Previous Versions feature, forcing payment for decryption. A is wrong because the /delete flag deletes shadow copies; creating them uses vssadmin create shadow. C is wrong because the /all /quiet flags with delete shadows unambiguously delete all shadow copies; resizing uses vssadmin resize shadowstorage. D is wrong because listing shadow copies uses vssadmin list shadows; the command shown explicitly deletes them.